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1 . A method of tracing data traffic on a network, the method comprising: 
at the transport layer of a protocol stack residing on a first device in the network, 
detecting a transmission or receipt of data to or from a second device on the network; and 
in response to the transmission or receipt being detected, recording the transmission or 
receipt as an entry in a trace log, wherein the trace log is accessible to determine the 
volume of data traveling over a network. 



2. The method of claim 1, wherein the protocol stack is a TCP/IP stack. 
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3. The method of claim 1, wherein the detection step further comprises the 
step of detecting the presence of an input/output packet representing the transmission or 
receipt. 

4. A method of tracing a transmission of data over a computer network 
comprising: detecting a transport-layer request to transmit an input/output packet; 
searching the input/output packet to determine an identity of a process that created the 
input/output packet; and storing in a trace log an entry representing the request, wherein 
the entry comprises the identity of the process, and wherein the trace log is accessible to 
determine a volume of data being transmitted over the network. 

5. The method of claim 4, further comprising: detecting an acknowledgment 
of the transmission; and in response to the detection of the acknowledgment, storing in 
the trace log an entry representing the completion of the transmission. 

6. A method of tracing a receipt of data from a computer network comprising: 
detecting a transport-layer request to transmit a packet for an input/output connection to a 
port; searching the packet to determine an identity of a process that created the packet; 
and in response to the detection of a receipt of data at the port, storing in a trace log an 
entry representing the receipt of the data, wherein the entry comprises the process 

II 
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identification, and wherein the trace log is accessible to determine a volume of the data 
being transmitted over the network. 

7. The method of claim 6, further comprising: creating a connection object 
representing the opening of the port cormection by the process; copying the process 
identification from the connection object into a transport control block associated with 
the port; and in response to the detection of the receipt of data at the port, copying the 
process identification into the trace log. 

8. The method of claim 7, further comprising: copying the process 
identification from the connection object into the transport control block so that the 
process identification is contiguous with the rest of the data in the transport control block. 

9. The method of claim 8, further comprising: detecting the presence of an 
input/output request packet indicating that the data receipt is complete; and in response to 
the detection of the completion input/ouput request packet, making an entry representing 
the receipt of the data into a trace log. 

10. A facility for tracing data traffic on a network, the facility comprising: an 
identifying means for identifying a process causing a transport-layer request to transmit 

III 
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data via the network; and a logging means in communication with the identifying means 
for logging and event, wherein the event comprises the identification the process and 
wherein the logging means is useable to determine a volume of data traveling over the 
network. 

1 1 . The apparatus of claim 10 wherein the identifying means further comprises 
means for communicating with a transport layer of a protocol stack. 

12. A computer-readable medium having stored thereon computer-executable 
instructions for performing steps comprising: at the transport layer of a protocol stack 
residing on a first device in the network, detecting a transmission or receipt of data to or 
from a second device on the network; and in response to the transmission or receipt being 
detected, recording the transmission or receipt as an entry in a trace log, wherein the trace 
log is accessible to determine the volume of data traveling over a network. 

13. The computer-readable medium of claim 12, wherein the protocol stack is a 
TCP/IP stack. 



IV 
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14. The computer-readable medium of claim 12, having further computer- 
executable instructions for performing the step of detecting the presence of an 
input/output packet representing the transmission or receipt. 

15. A computer-readable medium having stored thereon computer-executable 
instructions for performing steps comprising: detecting a transport-layer request to 
transmit an input/output packet; searching the input/output packet to determine an 
identity of a process that created the input/output packet; and storing in a trace log an 
entry representing the request, wherein the entry comprises the identity of the process, 
and wherein the trace log is accessible to determine a volume of data being transmitted 
over the network. 

16. The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting the presence of the 
input/output packet at the transport layer of a protocol stack. 

17. The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting an acknowledgment of the 
transmission; and in response to the detection of the acknowledgment, storing in the 
trace log an entry representing the completion of the transmission. 
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18. A computer-readable medium having stored thereon computer-executable 
instructions for performing the steps comprising: detecting a transport-layer request to 
transmit a packet for an input-output connection to a port; searching the packet to 
determine an identity of a process that created the packet; and in response to the detection 
of a receipt of data at the port, storing in a trace log an entry representing the receipt of 
the data, wherein the entry comprises the process identification, and wherein the trace log 
is accessible to determine the volume of the data being transmitted over the network. 

19. The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: creating a connection object 
representing the opening of the port connection by the process; copying the process 
identification from the connection object into a transport control block associated with 
the port; and in response to the detection of the receipt of data at the port, copying the 
process identification into the trace log. 

20. The computer-readable medium of claim 18, having further computer- 
executable instmctions for performing the step of copying the process identification from 
the connection object into the transport control block so that the process identification is 
contiguous with the rest of the data in the transport control block. 

VI 
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21 . The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: detecting the presence of an 
input/output request packet indicating that the data receipt is complete; and in response to 
the detection of the completion input/output request packet, storing in the trace log an 
entry representing the receipt of the data. 

22. The method of claim 1, wherein the transmission of data is recorded at the 
completion of the transmission indicated by an acknowledgement from the first device. 

23. The method of claim 1, wherein the receipt of data is recorded at the receipt 
of a first block of data and a last block of data. 

24. The method of claim 4, wherein the identity of the process includes a port 
number or an IP address relating to the transmission. 
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